Recent investigations by cybersecurity researchers have revealed that Chinese threat actor Storm-2603 has been exploiting critical vulnerabilities in Microsoft SharePoint, deploying an advanced malware suite known as Project AK47. This campaign has been active since at least March 2025 and has already compromised numerous organizations, including sensitive government entities. According to Microsoft, the vulnerabilities identified as CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, and CVE-2025-53771 allow for remote code execution, which can lead to unauthorized access and lateral movement within networks. 'These vulnerabilities have been actively exploited by at least three state-affiliated Chinese groups,' Microsoft stated, highlighting the severity of the situation. Unit 42 researchers from Palo Alto Networks have linked the exploit chain to a malware suite that includes multi-protocol backdoors, ransomware, and loaders, indicating a sophisticated level of threat. The ransomware variant, X2ANYLOCK, has been observed in the wild, demanding ransom payments in Bitcoin. Furthermore, the use of shared Tox IDs and links to known ransomware campaigns suggest a coordinated effort among various threat actors. The ToolShell exploit chain was first identified during a hacking competition in May 2025, with Microsoft releasing patches only in July. During the interim, several systems were breached, raising concerns about the security of government agencies such as the National Nuclear Security Administration and the Department of Homeland Security. As the situation evolves, experts recommend immediate patching of affected SharePoint versions to mitigate the risks associated with these vulnerabilities. Cybersecurity officials are urging organizations to review their security postures and implement robust defensive measures to prevent exploitation of these vulnerabilities in the future.
